[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <52263A79.1040404@redhat.com>
Date: Tue, 03 Sep 2013 13:37:29 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Bastien ROUCARIES <roucaries.bastien@...il.com>
Subject: Re: CVE request for imagemagick bug
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 08/29/2013 05:24 PM, Bastien ROUCARIES wrote:
> The gif handling code of imagemagick allow execution of arbitrary
> code due to a buffer overflow of one byte. Gif image format is made
> of different kind of data unit called block and these block may
> appear at anytime. The code actually do the equivalent of
> a=malloc(length+count) [line 1 of the patch] and
> a[length+count]='\0' for each comment block [line 11 of patch].
> Because this code is executed for every comment block and that an
> attacker could put arbitrary block between each comment block, and
> finaly this attacker could smash memory particularly on
> architecture where malloc layout is predictable. Worst the bug
> could be exploited remotly throught php-magick or perlmagick. A
> special image leading to malloc space corruption and thus a dos is
> available.
>
> Imagemagick before version 6.7.8-8 are affected.
>
> See upstream bug report here:
> http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=23921
>
> First reported as a dos here:
> https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1218248
>
> Fixed by commit:
> http://trac.imagemagick.org/changeset/8770/ImageMagick/trunk/coders/gif.c
>
> Analysis by myself
>
Please use CVE-2013-4298 for this issue.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)
iQIcBAEBAgAGBQJSJjp5AAoJEBYNRVNeJnmTW8IP/19g8bncqMvQq1HH8yd9/WGP
vZnrAlZOS8lPT/MeUQVVgOz9ft6Lyl1JDMIuFhL4zN0/pDDIvIO16ztd6kt71zHP
OMRt7Zi544d7galikjelje7RTEYJoWFUhRoBaAT6NDmEY61s6QtxKD1jUIZYlOU1
kXANs3THmQSrYI/sV9v+uZ4GH9jq/2g9iSSnO0H/sWoSe0m9YvI6k1q/Y2bRoUN1
laTqd2HSAYk4yy/q2PnlC4Coxh1PfadSYD+eMmJvXV5XVZMd/QhQxfGPYW35/YjZ
L/yXB4ur93cNax6E6Jc9dx5SM6l74I9SXsOGhvRA8r51p2jkOEdnyubNljmEpP09
tbDdzosJ2uslK3gN38fiaiwLITpT5DA+weTQ01J1CJBNbBeg3ZXBChukbUlhfdnM
K9jEoTj44GeJb5SWhG0lL26XWucExzdfVB+5SuX5Wle89BYQagzgyL6x1IoIugrO
vrOkSGEtwgQCvQlQByLGh5Qe+2h9hcbLd1sEv9gCHvhYeP7jEt5pAG7EP/UGPvBT
u0MQCND3ZSbtVkVFDo2LzgwkP2xZMJ/RRTdhyTnmnUp+Mp1A2k7AxysPr6VxDsr+
AT3kNuqpTUt8irkFZiTlcU767Y/SNM/nEaARbbyCs4zvu/nqSfEym91/RiwaEULN
sO4B9uKmJU3exYitJCCa
=JzSv
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
